Questions tagged [fortigate]

For questions about Fortigate, the UTM product line from Fortinet

Filter by
Sorted by
Tagged with
9
votes
2answers
8k views

load-balancing difference between DNS and IP - forwarding vs redirecting

I have come across a situation that I cannot understand. We have a Fortigate firewall that we have enabled to do load-balancing across two back-end Apache web servers. A DNS name is then mapped to ...
8
votes
2answers
24k views

Policy routing configuration in Fortigate

I have an scenario where a Fortigate firewall is used to separate internal networks from the Internet (FortiOS Version 4.0 MR3 patch 11). Right now there is a single Internet connection attached to ...
7
votes
1answer
9k views

Source NATing Fortigate typical scenario

I have a small query with respect to NATing in Fortigate.I'm struck in particular by a scenario where the remote network allows users with a specific IP range with a specific port for RDP over a ...
6
votes
2answers
3k views

Fortigate 100D internet on VLAN wan port

I am fairly new towards Fortigate firewalls and I am trying to set up one FortiGate 100D running firmware v5.0 as a router for a hotel network. I have 2 ISPs using PPPoE connection that runs on VLAN ...
6
votes
1answer
5k views

VPN client to multiple locations simultaneously

I need to connect to 15+ locations to run network scans weekly. All the locations have Fortigate firewalls over which I have full control. The current solution I have is to connect via IPSec VPN to ...
5
votes
8answers
6k views

How can I use SSL remote access VPN for connecting two sites?

I have a Fortigate 110C on my central site. I have a remote site office too. The users at the remote site need to access the central site via a VPN. Can I run SSL client software on one of the PC's or ...
5
votes
2answers
4k views

Fortigate HA: how to locate switch port connected to passive unit?

In a new customer's network I have found the following scenario: Fortigate 1 and 2 form and HA cluster in active-passive mode. The HA link is just a cable connecting them directly. Racks A and B are ...
5
votes
1answer
11k views

Fortigate reverse path check fail

I have a Fortigate 1240B with a vlan interface with IP 172.22.0.27/16. When a host directly connected try to ping my IP, I got the messages below. id=36871 trace_id=2 func=resolve_ip_tuple_fast line=...
4
votes
2answers
733 views

Is Fortigate-60D a fanless model?

I would like to know if Fortigate-60D is a fanless model or not. However, neither Fortigate-60D datasheet nor Fortinet Product Matrix provide any information about this topic. Could you please ...
4
votes
1answer
4k views

Fortigate 30D IPSEC VPN could not locate phase1 configuration

Hello network engineers, I have an IPSEC VPN tunnel between two offices, the HQ is a fortigate 200B(os:v5.0,build0292 (GA Patch 9)) and the branch is fortigate 30D(os:5.2.3). Both are now on static ...
4
votes
1answer
17k views

Fortigate: HTTP/HTTPS Traffic Connections Timeout

I'm having an oddball issue with HTTP/HTTPS traffic through my FG-100A running 4 MR3 Patch 18. The basic architecture is Internet<->Modem<->FG-100A<->Switch+WAP<->Clients. The switch is ...
4
votes
2answers
6k views

Fortigate logging: how to prevent ping to firewall interface to be logged while still getting logs for implicitly denied traffic

Is there a way to configure a fortinet firewall (e.g, fortigate600 running FortiOS 5 or FortiOS 4) so it do not generate log entries for pings that are directed to the firewall's own interfaces but ...
3
votes
5answers
37k views

How to get a list of ports listening in a Fortigate firewall?

Since several services can be offered by the Fortigate itself (SSH and web access for admin tasks, SSL VPN, IPSec VPN...) I would like to check at a glance all ports where any service is being offered ...
3
votes
3answers
791 views

Fortigate: enabling directed broadcast to broadcast conversion on last hop?

I'm not quite certain how to achieve the equivalent of ip directed broadcast with a FortiGate. In this case a FortiGate 60E with FortiOS 5.6.7. So I started to dig a little. QUESTION: Can anyone ...
3
votes
2answers
818 views

Fortigate user traffic quota

I'm trying to limit internet users by traffic quota in fortigate firewall.Is there a way to limit users traffic usage and set quota for them in fortigate? i think there is no built-in feature for ...
3
votes
3answers
2k views

How to check the ifIndex on a Fortigate 1500D?

What is the exact command to check the port ifIndex that is used by SNMP to reflect trap at SNMP host at 1500D Fortigate? The command diagnose sys device list root displays the index which isn't ...
3
votes
1answer
4k views

How to flush route cache in fortigate

Is there something like route cache on fortigate like in linux? How can i clear this cache? I have some problems with OSPF, after adding or changing redistributed network. Foritgate show routes ...
3
votes
1answer
4k views

How to prevent loop while trunking Fortigate and Cisco L2 Switches

I have inherited a rather weird setup at work, although my forte is servers and cloud, I have to look into network matters as well due to lack of resources. This setup has 2 x Fortigate 100Ds (FG1, ...
3
votes
2answers
1k views

where to NAT?where to run BGP?

in this diagram : we are peering with 2 ISPs, let's say I have a class c IP space like 200.200.200.0/24 and let's say my ASN is 65000, the thing is where should I run NAT? on which device? I mean on ...
3
votes
1answer
7k views

Fortigate Open Ports

I need to open this port in Fortigate: 443 PSOM/TLS Outbound Data sharing sessions But i dont know where I can open. I created a Custom Service, chose the option of TCP, but do not know if ...
3
votes
1answer
354 views

Cisco SG300 and Fortigate 90D integration

I need help in setting up my network, currently I have the following setup. All the computers can browse the internet but when I tried to create a two groups (a group that can access the internet and ...
3
votes
1answer
589 views

Need help to identify UTM/Firewall for SME network

I am planning to procure a UTM/Firewall device for our office network of 50 Nodes (can be increased upto 75). I want a comprehensive solution for optimum ISP bandwidth utilization, corporate content ...
3
votes
1answer
703 views

Direction incoming vs outgoing in logs

I'm trying to understand some Fortinet firewall logs but I'm not sure I fully understand what is being logged by the firewall when it comes to direction (Incoming vs Outgoing) For example: srcip=7.7....
2
votes
1answer
4k views

Fortigate “remembers” bad routes

I'm fairly new to Fortinet devices, so please let me know if I'm making a rookie mistake. I have a FortiGate 90D (v5.2.5,build701) which has an IPSec site-to-site VPN connection to another firewall ...
2
votes
1answer
79 views

Cannot Ping Firewall After Changing SFP

I am currently working on an issue that has me stumped... I have a network 172.16.144.0/20 which is connected to our fortigate 300D firewall via an Cisco 3850 external switch. Due to hardware ...
2
votes
2answers
806 views

Fortigate 200e as backbone switch

As part of the reorganization of the network of my company, I intend to apply the fortilink architecture, so I want to know if the fortigate 200e can also play the role of the backbone switch of ...
2
votes
1answer
904 views

MAC Address Filtering Fortinet v6.0

I am having trouble configuring mac filtering. I do not use DHCP but am trying to figure out a way to set a mac address on a port and create a rule to block that specific mac address. So when I try ...
2
votes
1answer
1k views

Fortigate 90D, web console unavailable, SSH console hangs on certain commands

The web console just gets connection refused. The SSH console connects but hangs when when i: Attempt to change the configuration. (Hangs after the end command) Attempt to restore from a config ...
2
votes
2answers
586 views

Fortigate interfaces in policies

What are the implications of not using interfaces when defining policies on fortigate firewalls? i.e Policy would be edit 1 set srcintf "any" set dstintf "any" set srcaddr "ip-192.168.1....
2
votes
1answer
2k views

Connecting to fortigate 5.4 with vpnc (ipsec)

I have a fortigate 90b(?) running 5.4. wan1 is set to a publically accessible address. Our internal network is 192.168.100.0 I can connect via ipsec and I can access the gateway, which is the ...
2
votes
1answer
376 views

Fortigate - Redirecting subdomains only?

I'm trying to figure out a way to have our Fortigate 60C redirect certain subdomains but not block complete access to the domain. E.G. I want to block update.microsoft.com but I don't want microsoft....
2
votes
3answers
25k views

How to disable unused LAN ports on Fortigate

I know I can set the administrative status of WAN/DMZ ports to down to disable them, but I can only see how to set the entire internal interface up/down. Is there a way to set individual LAN ports ...
2
votes
1answer
115 views

Fortigate 800C is not displaying the data for IDS/sniffer traffic on Log&Report

I have a Fortigate 800C in Flow based inspection and configured one-arm sniffer mode on an interface and configured a firewall sniffer with below config config firewall sniffer set ips-sensore-...
2
votes
2answers
239 views

Multiple url filter list in fortigate

is this possible to use multiple urlfilter lists in web filtering on fortigate? I need to block specified sites for one user group and other sites for another user group but it looks like there is ...
2
votes
3answers
4k views

GRE over IPsec between Juniper SRX100 and Fortigate 100D

I need assistance configuring VPN setup between Fortigate and Juniper devices (GRE over IPSec). I have the topology as follows: What I need to do is create a route-based IPSec tunnel between the ...
2
votes
1answer
3k views

Printer on wired LAN not accessible from wifi in a differnet subnet

My network diagram is as follows: The printer on the 2-network responds to pings from the 3-wifi-network for sometime and then just drops out for some reason i can’t figure out. I have policies on ...
2
votes
1answer
4k views

How to rename an existing FortiGate VDOM

I need to rename an existing Fortigate 100D VDOM. I cannot find the command unless it's really counter-intuitive. Furthermore, if this is not possible, can I copy the existing VDOM to a new one with ...
2
votes
1answer
2k views

Dedicated SBC really required for SIP trunking through a FortiGate 200B firewall?

I work at a school with a mid-sized ShoreTel deployment; two ShoreGear T1 trunk units and 15 ShoreGear 120/24 switches. We have a couple hundred IP phones and a couple hundred analog extensions (dorms)...
2
votes
0answers
4k views

Fortigate PPTP default gateway configuration

I have a fortigate 40C running with a PPTP configuration. My VPN works partly. I can connect to the office network, however I can't get the default gateway working. Can anyone help me with figuring ...
1
vote
1answer
20k views

How do I reset a Fortigate firewall password without resetting the firewall [closed]

I am new to IT, and I want to login to a Fortigate 60D firewall, but I don't know the password. How do I reset the firewall password without resetting the firewall.
1
vote
1answer
1k views

How to check last executed commands by users at FortiGate

How to check last executed commands by users at FortiGate firewall like show cli history at SRX firewall
1
vote
2answers
3k views

Why traffic shape/police ingress traffic?

Pardon me for my ignorance. I have not tried QoS nor traffic shaping/policing before. I have been pondering on whether can/why would we want to shape/police ingress traffic if you have no control ...
1
vote
2answers
1k views

Fortigate VRRP or HA config

I have 2xFG 600D for redundancy setup, where to use VRRP and HA configuration? which one is optimal for Nat mode ?
1
vote
1answer
3k views

NAT port is exhausted

I have fortigate 300C, since today morning I am getting error NAT port is exhausted and also I observed high bandwidth consumption due to which links were getting flapped. I have search on google but ...
1
vote
2answers
20k views

FortiGate HA (A/A) Cluster: How can I manage the slave unit from the web GUI?

I am confused to what happened to the slave's IP address. Before I set both my units to Active/Active cluster, I could reach each of them with their own IP. Now, I can still reach the master unit with ...
1
vote
1answer
185 views

Dropping packets between router and firewall without firewall rule

I have a user that is trying to access his company network resources on his home network. He is able to access SMB shares and other resources, but he is unable to access their AS400 on any computer in ...
1
vote
2answers
253 views

Unable to access Server over VPN behind 2 Fortigate Firewalls; however ping is working

Client -> VPN -> FG1 -> FG2 -> Server Created a VPN tunnel with remote IP 10.20.30.4/32 and local ip 10.20.30.40/32 on FG1, NAT/VIP is established with VIP as 10.20.30.40 and server IP as 192.168.2.6 ...
1
vote
2answers
379 views

Fortigate 60D - WAN Link Traffic Division

Requirement is to divide the WAN zone traffic Two different LAN IP group's internet traffic should go though 2 different WAN connections in fortigate 60D (Currently its WAN Zone(wan1 and wan2) . How ...
1
vote
1answer
745 views

Fortigate 90D SD-WAN: VPN and VoIP

i am contemplating the idea of switching our current FG 80D to a 90D and implement SD-WAN using our current 100Mbit fiber circuit (main) and the 4G LTE (cradlepoint) for internet backup. Our current ...
1
vote
2answers
5k views

fortigate 50e conditional forwarding

my first post here, any help is appreciated. I have a fortigate 50E with a bunch of PCs connected to it which form my internal network. One of the PCs is running a web app (Confluence to be precise). ...